CVE-2016-5007 Spring Security / MVC Path Matching Inconsistency

[php-coder]

More info:

• https://spring.io/blog/2016/07/08/cve-2016-5007-spring-security-mvc-path-matching-inconsistency
• http://pivotal.io/security/cve-2016-5007

[cplvic]

Hey @jasinner
I can do the pull request but this issue affects 2 packages, Spring Framework and Spring Security (distinct artifact IDs)/ How do I create the relevant yaml file?

nevermind - I found an example :D

[cplvic]

Pull Request #71

[cplvic]

Dumb question, If I wanted to indicated the affected version is anything under 4.0.x
what is the syntax ?

would it be

">=4.0.0.Final,4.0"

?

[jasinner]

Hi @cplvic,
For anything under 4.0.0.Final you should just use >=4.0.0.Final. The YAML file seems incorrect, as you haven't specified the appropriate ranges ie.:

<=3.2.10.RELEASE,3.2
<=4.0.4.RELEASE,4.0

and

<=3.2.18.RELEASE,3.2
<=4.0.9.RELEASE,4.0
<=4.1.9.RELEASE,4.1
<=4.2.9.RELEASE,4.2

Regards

[cplvic]

so then are my previous submissions that were committed correct?
9878.yaml, 9879.yaml, 4970.yaml because i haven't specified ranges in those either. Take a look and let me know.
What I will do is cancel this pull request (71) and do an bigger update to correct everything in one pass.